From 7c560b2f3bd8869c65a3e780d27c4e05b0316001 Mon Sep 17 00:00:00 2001
From: Lycidias93 <42116872+Lycidias93@users.noreply.github.com>
Date: Sun, 6 Sep 2026 03:02:29 +0200
Subject: [PATCH] ci: fix release body verification without rendered newline

---
 .github/workflows/release-v4.8.3-final.yml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release-v4.8.3-final.yml b/.github/workflows/release-v4.8.3-final.yml
index 96a8e19..75c5431 100644
--- a/.github/workflows/release-v4.8.3-final.yml
+++ b/.github/workflows/release-v4.8.3-final.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   release:
-    if: startsWith(github.event.head_commit.message, 'Arm Sortify 4.8.3 REST release final path')
+    if: startsWith(github.event.head_commit.message, 'Arm Sortify 4.8.3 REST release bodyfix path')
     runs-on: ubuntu-latest
     timeout-minutes: 20
     env:
@@ -103,6 +103,7 @@ jobs:
           test "$(jq -r '.object.type' "$RUNNER_TEMP/tag-created.json")" = "commit"
           test "$(jq -r '.object.sha' "$RUNNER_TEMP/tag-created.json")" = "$TARGET_COMMIT"
           test "$(gh api "repos/$REPO/git/ref/tags/$TAG" --jq '.object.sha')" = "$TARGET_COMMIT"
+          echo "release_stage=tag_verified"
 
           jq -n             --arg tag "$TAG"             --arg target "$TARGET_COMMIT"             --arg title "$RELEASE_TITLE"             --rawfile body "$RELEASE_NOTES_PATH"             '{tag_name:$tag,target_commitish:$target,name:$title,body:$body,draft:true,prerelease:false}'             > "$RUNNER_TEMP/create-release.json"
 
@@ -114,9 +115,11 @@ jobs:
           test "$(jq -r '.name' "$RUNNER_TEMP/release-created.json")" = "$RELEASE_TITLE"
           test "$(jq -r '.draft' "$RUNNER_TEMP/release-created.json")" = "true"
           test "$(jq -r '.prerelease' "$RUNNER_TEMP/release-created.json")" = "false"
+          echo "release_stage=draft_created"
 
-          gh api "repos/$REPO/releases/$release_id" --jq '.body' > "$RUNNER_TEMP/release-body.txt"
-          cmp -s "$RELEASE_NOTES_PATH" "$RUNNER_TEMP/release-body.txt"
+          gh api "repos/$REPO/releases/$release_id" > "$RUNNER_TEMP/release-readback.json"
+          jq -e --rawfile expected "$RELEASE_NOTES_PATH" '.body == $expected' "$RUNNER_TEMP/release-readback.json" >/dev/null
+          echo "release_stage=body_verified"
 
           curl --fail-with-body --silent --show-error -L             -X POST             -H "Authorization: Bearer $GH_TOKEN"             -H "Accept: application/vnd.github+json"             -H "X-GitHub-Api-Version: 2026-03-10"             -H "Content-Type: application/zip"             --data-binary "@$ASSET_PATH"             "https://uploads.github.com/repos/$REPO/releases/$release_id/assets?name=$ASSET_NAME"             > "$RUNNER_TEMP/asset-created.json"
 
@@ -127,6 +130,7 @@ jobs:
           if [ -n "$asset_digest" ]; then
             test "$asset_digest" = "sha256:$ASSET_SHA256"
           fi
+          echo "release_stage=asset_uploaded"
 
           gh api "repos/$REPO/releases/$release_id/assets" > "$RUNNER_TEMP/assets.json"
           test "$(jq --arg name "$ASSET_NAME" --argjson size "$ASSET_BYTES" '[.[] | select(.name == $name and .size == $size and .state == "uploaded")] | length' "$RUNNER_TEMP/assets.json")" = "1"
@@ -141,11 +145,13 @@ jobs:
           test "$(gh api "repos/$REPO/releases/tags/$TAG" --jq '.draft')" = "false"
           test "$(gh api "repos/$REPO/releases/tags/$TAG" --jq '.prerelease')" = "false"
           test "$(gh api "repos/$REPO/git/ref/tags/$TAG" --jq '.object.sha')" = "$TARGET_COMMIT"
+          echo "release_stage=published"
 
           mkdir -p "$RUNNER_TEMP/public-release"
           env -u GH_TOKEN -u GITHUB_TOKEN curl -fL --retry 3 --retry-delay 2 --retry-all-errors             -o "$RUNNER_TEMP/public-release/$ASSET_NAME"             "https://github.com/$REPO/releases/download/$TAG/$ASSET_NAME"
           test "$(stat -c '%s' "$RUNNER_TEMP/public-release/$ASSET_NAME")" = "$ASSET_BYTES"
           printf '%s  %s\n' "$ASSET_SHA256" "$RUNNER_TEMP/public-release/$ASSET_NAME" | sha256sum -c -
+          echo "release_stage=public_hash_verified"
 
           trap - EXIT
           echo "RESULT: SORTIFY_V483_PUBLIC_RELEASE_DONE outcome=success release_kind=stable asset_sha256=$ASSET_SHA256 asset_bytes=$ASSET_BYTES"